Security
What we do to protect your data
Surgi-Sys stores chart numbers against the supplies used on a case. That is information about identifiable patients, and it is treated accordingly.
A separate database per facility
Your records are not rows in a shared table with a customer column. Each customer is provisioned its own PostgreSQL database. Membership checks select the workspace, and new databases use separate restricted runtime credentials. These controls are verified during deployment.
Chart numbers never leave your database
The shared registry that handles sign-in and billing holds your facility name, your users' email addresses and your subscription. It holds no case records, no chart numbers and no inventory. Those exist only in your own database.
Encryption in transit and at rest
Production deployments require HTTPS and encrypted database storage. The credentials for your database are themselves encrypted with AES-256-GCM before being stored, so a copy of the registry is not enough to reach any customer's data.
Passwords nobody can read
Passwords are hashed with scrypt, a deliberately slow, memory-hard function. We cannot see them, and neither can your administrator — invitations let people set their own. Repeated failed sign-ins lock an account temporarily.
Access control that is enforced, not advertised
Five roles, from read-only to owner, with permissions checked at the point every change is made rather than only in the navigation. Obtaining a database connection and proving you are a member of that facility are the same operation, so a page cannot forget to check.
Inventory audit history
Every change to a quantity writes a ledger entry recording who, when, how much and why — in the same database transaction as the change itself. Vendor, item, card and user changes are logged separately with a field-level record of what moved.
Sessions you can end
Sessions are stored server-side, so deactivating someone ends their access immediately rather than whenever their token happens to expire. Changing a password signs out every other browser — which matters when the workstation is shared.
Backups, and a restore path per customer
Production deployment requires scheduled backups and tested restoration. Because each customer is separate, restoring one customer to a point in time does not involve anybody else's data.
HIPAA and business associate agreements
We will sign a BAA on request.
If you store chart numbers in Surgi-Sys, we are handling protected health information on your behalf, and a business associate agreement is the right way to formalise that. Ask and we will send one for review.
We want to be precise about what that does and does not mean. There is no such thing as HIPAA certification — no body issues it, and any vendor claiming to be certified is describing something that does not exist. What we can tell you is what we actually do, which is on this page, and what we will contractually commit to, which is in the agreement.
We do not currently hold a SOC 2 report. If your procurement process requires one, tell us during evaluation rather than after — we would rather say so now than waste your time.
Reducing what you store
The safest information is the information you never send us. A case in Surgi-Sys needs one reference that ties it back to your own patient record — nothing more.
- Do use your internal chart or accession number.
- Do not put patient names, dates of birth or clinical detail in the chart field or in case notes.
- There is no field in Surgi-Sys that asks for any of those, and the case record is designed so it never needs them.
Recall traceability works from the chart number alone: we tell you which references received the lot, and you look them up in the system that is meant to hold that.
Common questions
- Where is the data hosted?
- In the United States. Tell us during evaluation if you have a specific residency requirement and we will confirm whether we can meet it before you commit.
- Who on your side can see our data?
- Access is limited to the people who operate the service, is used only to investigate a problem you have raised or an incident we have detected, and is logged. We do not use your data to train anything or share it with anyone.
- What happens to our data if we leave?
- It stays intact and readable while your workspace is read-only. Ask for an export at any time and we will send you a complete copy at no charge. When you confirm you have it and want the workspace removed, we delete the database.
- How do you handle a breach?
- We will tell you. If we determine that data in your workspace has been accessed without authorisation, we will notify you without undue delay with what we know, what we do not yet know, and what we are doing — and the BAA sets out those obligations formally.
- Do you support single sign-on?
- Not yet. If SSO is a requirement for your organisation, tell us — it is the most requested thing we do not have.
- Can we run it entirely on our own infrastructure?
- Yes. Surgi-Sys runs on any host with Node and PostgreSQL and works with billing switched off, so nothing leaves your network. Ask about a self-hosted licence.
- How do we report a vulnerability?
- Email support@surgi-sys.com with the details. We will acknowledge within one business day, and we will not threaten anyone who reports a problem in good faith.
Send this page to your compliance officer
Then start a trial. We will have the BAA ready before you go live.